# Mandatory legal documents for a business in France: the table by activity (2026)

> Every business website in France must display a legal notice, and every business that processes customer data must inform people (privacy policy) and keep a record of processing activities. Selling online to consumers adds pre-contractual information (terms of sale), a consumer mediator and, since 19 June 2026, an online withdrawal function. From the first employee, you also need the single risk assessment document (DUERP), the staff register and the mandatory workplace notices; internal rules become mandatory twelve months after reaching 50 employees.

Source: https://legalnest.io/en/guides/mandatory-legal-documents-france/
Updated on 8 October 2026. Checked against the law in force on 07/10/2026.
General information, not personalised legal advice.

In October 2024, the CNIL (the French data protection authority) [announced](https://www.cnil.fr/fr/onze-nouvelles-sanctions-procedure-simplifiee) (in French) that it had sanctioned “two companies with fewer than 250 employees for having no record of processing activities” (our translation). Not a data breach: a missing internal document. Founders think of the legal notice because it is visible, and forget what is not. And the list changes depending on whether you sell to consumers, publish software, invoice other businesses or hire staff. Here is the full matrix, profile by profile, with the legal text behind every cell.

Some of these rows are EU-wide: the privacy policy, the record of processing and the data processing agreement come from the GDPR, the cookie rules from the ePrivacy Directive (applied in France by article 82 of the French Data Protection Act), and the online withdrawal function from Directive (EU) 2023/2673. The other texts cited here are French: the LCEN for the legal notice, the Consumer Code and the Commercial Code for sales and payment terms, and the Labour Code for every employer document.

## Which legal documents are mandatory for a business in France?

Three documents apply to almost every business with a website: a legal notice, a privacy policy and a record of processing activities. The rest depends on what you do: terms of sale, a consumer mediator and online withdrawal for consumer sales, a data processing agreement (DPA) whenever one party processes data on behalf of another, and employer documents from the first hire.

The first four profile columns describe a business with no employees. The last column applies on top of your profile from the first hire.

| Document | Brochure website | B2C e-commerce | B2B SaaS / software | B2B freelancer or service provider | With employees (on top) |
|---|---|---|---|---|---|
| Legal notice (« mentions légales ») | Mandatory | Mandatory | Mandatory | Mandatory (if website) | Depends on activity |
| Privacy policy | Mandatory in practice | Mandatory | Mandatory | Mandatory in practice | Informing employees |
| Cookie banner and cookie policy | Depends | Depends | Depends | Depends | Depends on activity |
| Record of processing activities | Mandatory in practice | Mandatory | Mandatory (two records) | Mandatory in practice | Mandatory (payroll, HR) |
| Data processing agreement (DPA) | Depends | Mandatory | Mandatory | Depends | Depends |
| Terms of sale (« CGV ») | Depends | Mandatory in practice | Recommended; provide on request | Recommended; provide on request | Depends on activity |
| Terms of use (« CGU ») | No | Recommended | Recommended | No | Depends on activity |
| Consumer mediator | Depends | Mandatory | No | No | Depends on activity |
| Online withdrawal function | No | Mandatory | No | No | Depends on activity |
| Single risk assessment document (DUERP) | No | No | No | No | Mandatory |
| Staff register | No | No | No | No | Mandatory |
| Mandatory workplace notices | No | No | No | No | Mandatory |
| Internal rules (« règlement intérieur ») | No | No | No | No | From 50 employees |

**How to read the cells.** “Mandatory”: a legal text requires it. “Mandatory in practice”: the obligation depends on a condition that almost everyone meets (collecting data, processing it on a regular basis). “Depends”: it turns on a fact explained below. “Recommended”: no text requires it, but it protects you.

For your own list, the [free obligations check](https://app.legalnest.io/tools/obligations?lang=en) starts from your SIREN (company registration number, optional), your headcount and a few questions, and cites the legal text behind each line.

## Which French and EU laws apply to each document?

Every cell rests on a text: the LCEN (the French Law on Confidence in the Digital Economy), the [GDPR](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679), the French Data Protection Act (« loi Informatique et Libertés »), the Consumer Code, the Commercial Code or the Labour Code.

| Document | Legal basis | When it is mandatory |
|---|---|---|
| Legal notice | [LCEN, art. 1-1](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000049568614) | Any website published in a professional capacity |
| Privacy policy | [GDPR, Articles 13 and 14](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679) | As soon as you collect personal data |
| Cookie banner and cookie policy | [Law no. 78-17, art. 82](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978) | As soon as a non-exempt tracker is set: prior consent and information |
| Record of processing activities | [GDPR, Article 30](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679) | Any processing that is not occasional, whatever your size |
| Data processing agreement (DPA) | [GDPR, Article 28](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679) | As soon as a provider processes data for you, or you for a client |
| Terms of sale to consumers | [Consumer Code, L111-1](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000044142438) and [L221-5](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000053310511) | Pre-contractual information, in detail for distance selling |
| Terms of sale between businesses | [Commercial Code, L441-1](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000038414469) and [L441-10](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000038414392) | Not mandatory; provide them on request if they exist; payment terms mandatory |
| Terms of use | [Civil Code, art. 1119](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000032040866) | No text requires them; enforceable only if accepted |
| Consumer mediator | [Consumer Code, L612-1](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000032224805) and [L616-1](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000032224762) | Any professional who contracts with consumers |
| Online withdrawal function | [Consumer Code, L221-21](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000053310520) | Distance contracts concluded through an online interface, since 19 June 2026 |
| DUERP | [Labour Code, L4121-3-1](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000043893919) and [R4121-1](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000023795562) | From the first employee |
| Staff register | [Labour Code, L1221-13](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000033971569) | Any establishment that employs staff |
| Mandatory workplace notices | [Labour Code, D4711-1](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000018527636) and the texts listed by [Entreprendre Service Public](https://entreprendre.service-public.gouv.fr/vosdroits/F23106) (in French) | From the first employee, with more items at 11 and then 50 employees |
| Internal rules | [Labour Code, L1311-2](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000038610176) | 12 months after reaching 50 employees |

Since the 2024 SREN law, the [legal notice on a website](/en/guides/legal-notice-website-france/) rests on article 1-1 of the LCEN, no longer on article 6.

## Which legal documents do I need for my website in France?

A brochure website that sells nothing needs a legal notice, a privacy policy as soon as it has a form or audience measurement, and a cookie banner only if it sets trackers that require consent. Each activity you add (sales, customer accounts, hiring) brings its own documents.

```mermaid
flowchart TD
  A["You have a business website"] --> B["Legal notice, privacy policy, record"]
  B --> C{"Non-exempt trackers?"}
  C -->|Yes| D["Cookie banner and cookie policy"]
  C -->|No| E{"Selling online to consumers?"}
  D --> E
  E -->|Yes| F["Terms of sale, mediator, online withdrawal"]
  E -->|No| G{"At least one employee?"}
  F --> G
  G -->|Yes| H["DUERP, staff register, workplace notices"]
  H --> I{"50 employees for 12 months?"}
  I -->|Yes| J["Internal rules"]
```

Take a plumber whose website has a quote request form. Legal notice: yes. Privacy policy: yes, the form collects data. Record of processing: yes, he keeps a customer file. Cookie banner: only if he adds a tracker that requires consent, such as an advertising pixel or a non-exempt audience measurement tool ([Law no. 78-17, art. 82](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978)); the rules are in our guide to a [CNIL-compliant cookie banner](/en/guides/cookie-banner-france-cnil/). Consumer mediator: yes, because he works for private individuals; the obligation in [article L612-1 of the Consumer Code](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000032224805) depends on who your customers are, not on your website.

**With Legalnest**: Legalnest offers templates tailored through a questionnaire for your website documents (legal notice, privacy policy, cookie policy, terms of use, terms of sale) and your GDPR documents (record of processing activities, DPA, data breach procedure, retention policy). Its **compliance score** lists what you are missing based on six questions: data collection, cookies, user accounts, online sales, processors, sensitive or large-scale data. It tracks the status of your documents in Legalnest; it does not scan your website. [See the plans](/en/pricing/).

## Which documents does an e-commerce site selling to consumers need?

An online shop stacks the baseline of every website on top of the distance selling rules: complete terms of sale, a consumer mediator, an online withdrawal function and a DPA with each of its providers (platform, payments, email marketing).

The sole trader selling candles on Shopify escapes none of these rows. Her terms of sale gather the information that [article L221-5](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000053310511) requires before the order: identity, price, delivery times, withdrawal conditions with the model form, legal guarantees, mediator. The [Entreprendre Service Public fact sheet on terms of sale](https://entreprendre.service-public.gouv.fr/vosdroits/F33527) (in French) presents them as mandatory when selling to consumers. The detail is in our guide [Terms of sale in France: mandatory or not?](/en/guides/terms-of-sale-france/).

Since 19 June 2026, [article L221-21](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000053310520) also requires a free function for withdrawing online, and her pre-contractual information (in practice, her terms of sale) must state that it exists and where to find it ([L221-5, 7°](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000053310511)). Terms of sale written before that date are incomplete; see our guide to the [EU withdrawal button](/en/guides/withdrawal-button-eu/).

The mediator’s contact details must be given to the consumer ([art. L616-1](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000032224762)): on the website, in the terms of sale and on order forms, says [Entreprendre Service Public](https://entreprendre.service-public.gouv.fr/vosdroits/F33338) (in French).

## Which documents does a B2B SaaS or software company need?

A B2B SaaS publisher needs a legal notice, a privacy policy and a record of processing, but above all a data processing agreement (DPA) to offer its customers: it processes, on their behalf, the data they load into the tool. Its terms of sale are not required, but if they exist, it must provide them to any customer who asks.

The heart of the matter is Article 28 of the GDPR:

**What the law says**

> Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller. […]
>
> Source: [Regulation (EU) 2016/679 (GDPR), Article 28(3)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679)

A company publishing scheduling software for small businesses therefore wears two hats. For its own prospects and customers, it is a controller (the record under Article 30(1)). For its customers’ employee schedules, it is a processor: a DPA with each customer, and a second record of processing activities “carried out on behalf of a controller” ([GDPR, Article 30(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679)). Its cloud host is a sub-processor, which it cannot engage “without prior specific or general written authorisation of the controller” (Article 28(2)): hence the list annexed to the DPA.

## Which documents does a B2B freelancer or service provider need?

A freelancer who only works for businesses needs a legal notice if they have a website, GDPR information and a record of processing. Terms of sale are optional, but the payment terms must include the mandatory payment clauses, and a DPA is required as soon as they process data for a client.

A developer with a one-person company (« SASU ») who works on an online shop’s customer database is that shop’s processor: the Article 28 DPA is mandatory, whether or not the client offers one. A strategy consultant who never touches the client’s data does not need one.

[Article L441-1 of the Commercial Code](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000038414469) only requires you to provide existing terms of sale to a professional customer who asks for them. Attach them to the quote and get them accepted, or they have no effect ([Civil Code, art. 1119](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000032040866)).

## Which documents are mandatory from the first employee in France?

From the first hire: the single occupational risk assessment document (« document unique d’évaluation des risques professionnels », DUERP), the staff register and the mandatory workplace notices. Internal rules only become mandatory twelve months after the business reaches fifty employees.

| Document | From 1 employee | From 11 employees | From 50 employees | Source |
|---|---|---|---|---|
| DUERP | Drawn up, updated after any significant change | Updated at least once a year | Annual prevention programme | [R4121-2](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000045386446), [L4121-3-1](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000043893919) |
| Staff register | Opened at the first hire | Same | Same | [L1221-13](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000033971569), [fact sheet F1784](https://entreprendre.service-public.gouv.fr/vosdroits/F1784) (in French) |
| Mandatory notices and information | To display: labour inspectorate, occupational doctor, emergency services, safety and fire instructions, collective working hours, access to the DUERP; by any means: paid leave, harassment, discrimination | Display the list of members of the CSE (staff representative committee) | By any means: internal rules, gender equality index if there is no website, profit-sharing agreement | [D4711-1](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000018527636), [fact sheet F23106](https://entreprendre.service-public.gouv.fr/vosdroits/F23106) (in French) |
| Internal rules | No | No | Yes, 12 months after reaching the threshold | [L1311-2](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000038610176) |

**The DUERP.** The employer records the results of the risk assessment in it, with an inventory of risks for each work unit ([art. R4121-1](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000023795562)). It is required from the first employee ([official fact sheet](https://entreprendre.service-public.gouv.fr/vosdroits/F35360), in French, checked on 22 July 2026). The document and its earlier versions are kept for forty years ([art. R4121-4](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000045386451)).

**The staff register.** Employees are entered in order of hiring, “at the time of hiring and indelibly”, and interns in a separate section ([art. L1221-13](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000033971569)). According to the [official fact sheet](https://entreprendre.service-public.gouv.fr/vosdroits/F1784) (in French), it can be kept in digital form, after consulting the CSE.

**Workplace notices.** Some information must be displayed, other information can be given “by any means”, for example on the intranet, according to the [Entreprendre Service Public fact sheet](https://entreprendre.service-public.gouv.fr/vosdroits/F23106) (in French) checked on 8 July 2026.

**Internal rules.**

**What the law says**

> L’établissement d’un règlement intérieur est obligatoire dans les entreprises ou établissements employant au moins cinquante salariés.
> 
> L’obligation prévue au premier alinéa s’applique au terme d’un délai de douze mois à compter de la date à laquelle le seuil de cinquante salariés a été atteint, conformément à l’article L. 2312-2. […]
> 
> *Unofficial translation:* Drawing up internal rules is mandatory in businesses or establishments employing at least fifty employees.
> 
> The obligation in the first paragraph applies at the end of a period of twelve months from the date on which the threshold of fifty employees was reached, in accordance with article L. 2312-2. […]
>
> Source: [Code du travail, art. L1311-2 (Labour Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000038610176)

The internal rules are submitted to the CSE for its opinion, sent to the labour inspector at the same time as they are published, and come into force at least one month after these formalities ([art. L1321-4](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000054140230)). In its version in force since 28 May 2026, this article no longer requires filing with the clerk of the employment tribunal (« conseil de prud’hommes »).

Employees are also people whose data you process: payroll and HR management belong in your record, as explained in our guide to the [GDPR record of processing activities](/en/guides/gdpr-record-of-processing/).

## What is the difference between a mandatory and a recommended document?

A document is mandatory when a legal text requires it; it is recommended when no text requires it but it protects you in a dispute. Terms of sale between businesses and terms of use are the two textbook examples.

| Situation | Status | What the law actually requires |
|---|---|---|
| Terms of sale between businesses | Recommended | Provide them on request if they exist (L441-1); payment clauses in the payment terms (L441-10) |
| Terms of use | Recommended | Nothing, but without acceptance they do not protect you (Civil Code, 1119) |
| DPA with a large provider | Mandatory | A contract that complies with Article 28; the provider’s standard terms often serve this purpose, provided you have checked them |

And the record of processing is not optional below 250 employees. The CNIL is explicit: it must include “non-occasional processing (for example: payroll management, management of customers/prospects and suppliers, etc.)”, according to [its page on the record](https://www.cnil.fr/fr/RGDP-le-registre-des-activites-de-traitement) (in French, our translation).

## What are the penalties for missing legal documents in France?

From €750 per employee for a missing staff register to one year in prison and a €75,000 fine for an unidentified website publisher, and up to 4% of worldwide turnover under the GDPR. These are ceilings, not price tags.

| Breach | Legal basis | Maximum for an individual | Maximum for a company |
|---|---|---|---|
| Website publisher not identified | [LCEN, art. 1-2](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000049568616) | 1 year in prison and €75,000 | €375,000 |
| Distance selling information (B2C terms of sale) | [Consumer Code, L242-10](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000044563241) | €15,000 | €75,000 |
| No online withdrawal function | [Consumer Code, L242-13](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000044563232) | €15,000 | €75,000 |
| Mediator’s contact details not given | [Consumer Code, L641-1](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000032224624) | €3,000 | €15,000 |
| Terms of sale not provided to a professional buyer | [Commercial Code, L441-1, IV](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000038414469) | €15,000 | €75,000 |
| Late payment interest and recovery fee missing from payment terms | [Commercial Code, L441-16](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000043750778) | €75,000 | €2,000,000 |
| Informing individuals (GDPR, Articles 13 and 14) | [GDPR, Article 83(5)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679) | €20m or 4% of worldwide turnover | €20m or 4% of worldwide turnover |
| Record or DPA (GDPR, Articles 28 and 30) | [GDPR, Article 83(4)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679) | €10m or 2% of worldwide turnover | €10m or 2% of worldwide turnover |
| Trackers without consent | [Law no. 78-17, art. 20](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037822794) | €10m or 2% of worldwide turnover | €10m or 2% of worldwide turnover |
| DUERP missing or out of date | [Labour Code, R4741-1](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000018527390) | €1,500 (€3,000 for a repeat offence) | €7,500 (€15,000 for a repeat offence) |
| Staff register | [Labour Code, R1227-7](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000030422217) | €750 per employee concerned | €3,750 per employee concerned |
| Internal rules | [Labour Code, R1323-1](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000037899552) | €750 | €3,750 |

For a company, the LCEN criminal fine is multiplied by five ([Criminal Code, 131-38](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000006417334)). Fourth and fifth class petty offences (« contraventions ») are capped at €750 and €1,500 ([Criminal Code, 131-13](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000006417259)), multiplied by five for a company ([131-41](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000006417342)); the repeat-offence amounts for the DUERP follow the [official fact sheet](https://entreprendre.service-public.gouv.fr/vosdroits/F35360) (in French). For the GDPR and trackers, the ceiling is whichever of the two amounts is higher. The CNIL can also use a simplified procedure, where the fine cannot exceed €20,000, or €100,000 if annual worldwide turnover exceeds €50 million ([Law no. 78-17, art. 22-1](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000054142442)): that is the route taken for the two no-record sanctions mentioned above. See our overview of [CNIL fines](/en/guides/cnil-fines/).

## What are the most common mistakes with mandatory legal documents?

The usual ones: thinking you are too small for a record of processing or a DUERP, citing an outdated article, copying a competitor’s terms of sale, publishing a cookie banner with no reject option and selling SaaS without a DPA.

**Six mistakes we keep seeing**

**“I’m too small for a record of processing.”** The Article 30(5) exemption falls away as soon as any processing is not occasional: your customer file is enough.

**“In accordance with article 6-III of the LCEN…”** It has been article 1-1 since the SREN law: the page has not been reviewed since 2024.

**A competitor’s terms of sale.** They name its mediator, list its withdrawal exclusions, and often predate 19 June 2026.

**A cookie banner with no reject button.** The CNIL requires that refusing trackers be [as easy as accepting them](https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies/FAQ) (in French).

**SaaS without a DPA.** Article 28 requires a contract between your customers and you: without it, neither they nor you are compliant.

**The DUERP “when we’re bigger”.** It is required from the first employee.

To see how online shops are doing in practice, read our [study on French e-commerce compliance in 2026](/en/guides/french-ecommerce-compliance-study-2026/).

## What compliance checklist should I follow for my business in France?

Tick the list for your profile, then the employer list if you have staff. To check what a visitor actually sees, run the [free website audit](https://app.legalnest.io/tools/website-audit?lang=en) or take the [website compliance quiz](/en/guides/website-compliance-quiz/).

**Brochure website**

- [ ] Up-to-date **legal notice** (LCEN, art. 1-1), reachable from every page
- [ ] **Privacy policy** as soon as a form, a newsletter or audience measurement collects data
- [ ] **Cookie banner** with a reject button if a non-exempt tracker is set
- [ ] **Record of processing activities**: contacts, quotes, customers
- [ ] **Consumer mediator** if you work for private individuals

**B2C e-commerce**

- [ ] Up-to-date **legal notice** (LCEN, art. 1-1)
- [ ] **Terms of sale** covering the information in article L221-5, accepted before payment
- [ ] Online **withdrawal function**, with its location stated in the terms of sale
- [ ] **Mediator** contact details on the website, in the terms of sale and on order forms
- [ ] Privacy policy, plus cookie banner and cookie policy if you use trackers
- [ ] Record of processing activities and a **DPA** with your platform, payment and email marketing providers

**B2B SaaS or software**

- [ ] Legal notice and privacy policy
- [ ] A **DPA** offered to every customer, with the list of your sub-processors
- [ ] **Two records**: as controller and as processor (Art. 30(1) and 30(2))
- [ ] **Terms of use** for accounts, terms of sale or subscription terms provided on request
- [ ] Late payment interest and the **€40 fixed recovery fee** ([art. D441-5](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000043197457)) in your payment terms

**B2B freelancer or service provider**

- [ ] Legal notice if you have a website
- [ ] Privacy policy if you collect prospects’ data
- [ ] Record of processing activities: customers, prospects, invoicing
- [ ] A **DPA** as soon as you process personal data for a client
- [ ] General terms attached to the quote and accepted, with the payment clauses

**Employer, on top of your profile**

- [ ] **DUERP** drawn up from the first employee, updated at least once a year from 11 employees
- [ ] **Staff register** opened at the first hire
- [ ] **Workplace notices**: occupational doctor, labour inspectorate, emergency services, safety and fire instructions, collective working hours, access to the DUERP; paid leave, harassment and discrimination communicated by any means
- [ ] Payroll and HR management entered in the **record of processing activities**
- [ ] **Internal rules** 12 months after reaching 50 employees

For a list tailored to you, run the [obligations check](https://app.legalnest.io/tools/obligations?lang=en); the other [free tools](/en/tools/) check your [legal notice](https://app.legalnest.io/tools/legal-notice?lang=en) and your [cookies](https://app.legalnest.io/tools/cookies?lang=en).

## Frequently asked questions

### Which legal documents are mandatory for a business website in France?

Every business website must display a legal notice (« mentions légales ») identifying the publisher, the publication director and the host, under article 1-1 of the LCEN. As soon as it collects data (contact form, audience measurement, user accounts), it needs a privacy policy within the meaning of Articles 13 and 14 of the GDPR. A cookie banner is only required for non-exempt trackers, and terms of sale, a consumer mediator and an online withdrawal function become mandatory once you sell online to consumers.

### Does a French micro-entrepreneur need legal documents on their website?

Yes: the rules target the professional, whatever the legal form. A « micro-entrepreneur » (French sole trader) must display a legal notice, inform the people whose data they collect and, in practice, keep a record of processing activities, because managing customers is not occasional processing. If they sell online to consumers, they also need complete terms of sale, a consumer mediator and an online withdrawal function.

### Are terms of use mandatory in France?

No law requires a document called « CGU » (terms of use). They are still strongly recommended once users create an account or post content, because they set the rules on access, suspension and liability. Like all standard terms, they only apply if the user was made aware of them and accepted them (article 1119 of the French Civil Code).

### Which documents are mandatory from the first employee in France?

From the first hire, the employer must draw up the single occupational risk assessment document (DUERP), open the staff register (« registre unique du personnel ») and display the mandatory workplace notices (labour inspectorate, occupational doctor, emergency services, safety instructions, collective working hours, among others). From eleven employees the DUERP must be updated at least once a year, and it is kept for forty years. Internal rules (« règlement intérieur ») only become mandatory twelve months after the business reaches fifty employees.

### Are terms of sale mandatory between businesses in France?

No. The French Commercial Code only requires a business that has drawn up terms of sale to provide them, on a durable medium, to any professional buyer who asks (article L441-1). However, payment terms must state the late payment interest rate and the fixed recovery fee (article L441-10), failing which a company faces an administrative fine of up to €2 million.

### Does a small business need a GDPR record of processing activities?

Almost always. Article 30(5) of the GDPR exempts organisations with fewer than 250 employees, but only for processing that is occasional, risk-free and involves no sensitive data; managing customers, prospects or payroll is enough to lose the exemption. In October 2024, the CNIL (the French data protection authority) announced that it had sanctioned two companies with fewer than 250 employees for having no record.


## Sources

- [Loi n° 2004-575 du 21 juin 2004 pour la confiance dans l’économie numérique (LCEN, Law on Confidence in the Digital Economy), art. 1-1](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000049568614) (Légifrance)
- [Loi n° 2004-575 du 21 juin 2004 pour la confiance dans l’économie numérique (LCEN), art. 1-2](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000049568616) (Légifrance)
- [Code de la consommation, art. L111-1 (Consumer Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000044142438) (Légifrance)
- [Code de la consommation, art. L221-5 (Consumer Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000053310511) (Légifrance)
- [Code de la consommation, art. L221-21 (Consumer Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000053310520) (Légifrance)
- [Code de la consommation, art. L242-10 (Consumer Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000044563241) (Légifrance)
- [Code de la consommation, art. L242-13 (Consumer Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000044563232) (Légifrance)
- [Code de la consommation, art. L612-1 (Consumer Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000032224805) (Légifrance)
- [Code de la consommation, art. L616-1 (Consumer Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000032224762) (Légifrance)
- [Code de la consommation, art. L641-1 (Consumer Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000032224624) (Légifrance)
- [Code de commerce, art. L441-1 (Commercial Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000038414469) (Légifrance)
- [Code de commerce, art. L441-10 (Commercial Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000038414392) (Légifrance)
- [Code de commerce, art. L441-16 (Commercial Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000043750778) (Légifrance)
- [Code de commerce, art. D441-5 (Commercial Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000043197457) (Légifrance)
- [Code civil, art. 1119 (Civil Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000032040866) (Légifrance)
- [Regulation (EU) 2016/679 (GDPR), art. 12 to 14: transparency and information to be provided (in French)](https://www.cnil.fr/fr/reglement-europeen-protection-donnees/chapitre3) (CNIL)
- [Regulation (EU) 2016/679 (GDPR), art. 28 and 30: processor and record of processing activities (in French)](https://www.cnil.fr/fr/reglement-europeen-protection-donnees/chapitre4) (CNIL)
- [Regulation (EU) 2016/679 (GDPR), art. 83: administrative fines (in French)](https://www.cnil.fr/fr/reglement-europeen-protection-donnees/chapitre8) (CNIL)
- [Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679) (EUR-Lex)
- [Le registre des activités de traitement (the record of processing activities, in French)](https://www.cnil.fr/fr/RGDP-le-registre-des-activites-de-traitement) (CNIL)
- [La CNIL a prononcé ces trois derniers mois onze nouvelles sanctions dans le cadre de la procédure simplifiée (the CNIL issued eleven new sanctions under the simplified procedure in the last three months, in French)](https://www.cnil.fr/fr/onze-nouvelles-sanctions-procedure-simplifiee) (CNIL)
- [Questions-réponses sur les lignes directrices modificatives et la recommandation « cookies et autres traceurs » de la CNIL (Q&A on the CNIL’s amended guidelines and recommendation on cookies and other trackers, in French)](https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies/FAQ) (CNIL)
- [Loi n° 78-17 du 6 janvier 1978 relative à l’informatique, aux fichiers et aux libertés (French Data Protection Act), art. 82](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978) (Légifrance)
- [Loi n° 78-17 du 6 janvier 1978 (French Data Protection Act), art. 20 (corrective measures and maximum fines)](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037822794) (Légifrance)
- [Loi n° 78-17 du 6 janvier 1978 (French Data Protection Act), art. 22-1 (simplified procedure), version in force since 28 May 2026](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000054142442) (Légifrance)
- [Code du travail, art. L4121-3-1 (Labour Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000043893919) (Légifrance)
- [Code du travail, art. R4121-1 (Labour Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000023795562) (Légifrance)
- [Code du travail, art. R4121-2 (Labour Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000045386446) (Légifrance)
- [Code du travail, art. R4121-4 (Labour Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000045386451) (Légifrance)
- [Code du travail, art. R4741-1 (Labour Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000018527390) (Légifrance)
- [Code du travail, art. L1221-13 (Labour Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000033971569) (Légifrance)
- [Code du travail, art. R1227-7 (Labour Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000030422217) (Légifrance)
- [Code du travail, art. D4711-1 (Labour Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000018527636) (Légifrance)
- [Code du travail, art. L1311-2 (Labour Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000038610176) (Légifrance)
- [Code du travail, art. L1321-4 (Labour Code, version in force since 28 May 2026)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000054140230) (Légifrance)
- [Code du travail, art. R1323-1 (Labour Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000037899552) (Légifrance)
- [Code pénal, art. 131-13 (Criminal Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000006417259) (Légifrance)
- [Code pénal, art. 131-38 (Criminal Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000006417334) (Légifrance)
- [Code pénal, art. 131-41 (Criminal Code)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000006417342) (Légifrance)
- [Document unique d’évaluation des risques professionnels (DUERP, single occupational risk assessment document, in French)](https://entreprendre.service-public.gouv.fr/vosdroits/F35360) (Entreprendre Service Public)
- [Registre unique du personnel (staff register, in French)](https://entreprendre.service-public.gouv.fr/vosdroits/F1784) (Entreprendre Service Public)
- [Quelles sont les obligations d’affichage dans une entreprise ? (what notices must a business display?, in French)](https://entreprendre.service-public.gouv.fr/vosdroits/F23106) (Entreprendre Service Public)
- [Conditions générales de vente (CGV) (general terms of sale, in French)](https://entreprendre.service-public.gouv.fr/vosdroits/F33527) (Entreprendre Service Public)
- [Médiation des litiges de la consommation (consumer dispute mediation, in French)](https://entreprendre.service-public.gouv.fr/vosdroits/F33338) (Entreprendre Service Public)